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Abstract. We present the type rules for a dependently typed core calculus together with a straight- 
forward implementation in Haskell. We explicitly highlight the changes necessary to shift from a 
simply-typed lambda calculus to the dependently typed lambda calculus. We also describe how to 
extend our core language with data types and write several small example programs. The article is 
accompanied by an executable interpreter and example code that allows immediate experimentation 
with the system we describe. 



1. Introduction 

Most functional programmers are hesitant to program with dependent types. It is said that type checking 
becomes undecidable; the type checker will always loop; and that dependent types are just really, really, 
hard. 

The same programmers, however, are perfectly happy to program with a ghastly hodgepodge of 
complex type system extensions. Current Haskell implementations, for instance, support generalized al- 
gebraic data types, multi-parameter type classes with functional dependencies, associated types and type 
families, impredicative higher-ranked types, and there are even more extensions on the way. Program- 
mers seem to be willing to go to great lengths just to avoid dependent types. 

One of the major barriers preventing the further proliferation of dependent types is a lack of under- 
standing amongst the general functional programming community. While, by now, there are quite a few 
good experimental tools and programming languages based on dependent types, it is hard to grasp how 
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these tools actually work. A significant part of the literature available on dependent types is written by 
type theorists for other type theorists to read. As a result, these papers are often not easily accessible to 
functional programmers. This article aims to remedy this situation. 

Most importantly, we aim to fill a gap in the literature. To set the scene, we study the simply-typed 
lambda calculus (Section 2). We present both the mathematical specification and Haskell implementation 
of the abstract syntax, evaluation, and type checking. Taking the simply-typed lambda calculus as starting 
point, we move on to a minimal dependently typed lambda calculus (Section 3). 

Inspired by Pierce's incremental development of type systems [21], we highlight the changes, both 
in the specification and implementation, that are necessary to shift to the dependently typed lambda 
calculus. Perhaps surprisingly, the modifications necessary are comparatively small. By making these 
changes as explicit as possible, we hope that the transition to dependent types will be as smooth as 
possible for readers already familiar with the simply-typed lambda calculus. 

While none of the type systems we implement are new, we believe that our paper can serve as a 
gentle introduction on how to implement a dependently typed system in Haskell. Implementing a type 
system is one of the best ways to learn about all the subtle issues involved. Although we do not aim to 
survey all the different ways to implement a typed lambda calculus, we do try to be explicit about our 
design decisions, carefully mention alternative choices, and provide an outline of the wider design space. 

The full power of dependent types can only come to its own if we add data types to this base calculus. 
Therefore we demonstrate how to extend our language with natural numbers and vectors in Section 4. 
More data types can be added using the principles explained in this section. Using the added data types, 
we write the classic vector append operation to illustrate how to program in our core calculus. 

Finally, we have made it easy to experiment with our system: the source code of this article contains 
a small interpreter for the type system and evaluation rules we describe. By using the same sources as the 
article, the interpreter is guaranteed to follow the implementation we describe closely, and is carefully 
documented. It hence provides a valuable platform for further education and experimentation. 

This article is not an introduction to dependently typed programming or an explanation on how to 
implement a full dependently typed programming language. However, we hope that this article will help 
to dispel many misconceptions functional programmers may have about dependent types, and that it will 
encourage readers to explore this exciting area of research further. 

2. Simply Typed Lambda Calculus 

On our journey to dependent types, we want to start on familiar ground. In this section, we therefore 
consider the simply-typed lambda calculus, or 2_> for short. In a sense, A_> is the smallest imaginable 
statically typed functional language. Every term is explicitly typed and no type inference is performed. It 
has a much simpler structure than the type lambda calculi at the basis of languages such as ML or Haskell 
that support polymorphic types and type constructors. In 1^ , there are only base types and functions 
cannot be polymorphic. Without further additions, is strongly normalizing: evaluation terminates for 
any term, independent of the evaluation strategy. 

2.1. Abstract syntax 

The type language of 1^ consists of just two constructs: 
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eljv 

e :: t l\, v x l\, x 

e jj. Xx -> v v[x \-> e'] j). v' e jj. n e' jj. v' e jj. v 

e e' l\, v' e e' l\, n V Ax — > e {J. Jjc — > v 

Figure 1. Evaluation in 1_> 



xv.— a base type 

| r — > r' function type 

There is a set of base types a; compound types x — > r' correspond to functions from r to r'. 

e v.— ev.x annotated term 1 

| x variable 

| e e> application 

| Xx — > e lambda abstraction 

There are four kinds of terms: terms with an explicit type annotation; variables; applications; and lambda 
abstractions. 

Terms can be evaluated to values: 

v ::—n neutral term 

| Xx — > v lambda abstraction 

n ::— x variable 
| n v application 

A value is either a neutral term, i.e., a variable applied to a (possibly empty) sequence of values, or it is 
a lambda abstraction. 



2.2. Evaluation 

The (big-step) evaluation rules of are given in Figure 1. The notation e jj. v means that the result of 
completely evaluating e is v. Since we are in a strongly normalizing language, the evaluation strategy is 
irrelevant. To keep the presentation simple, we evaluate everything as far as possible, and even evaluate 
under lambda. Type annotations are ignored during evaluation. Variables evaluate to themselves. 

The only interesting case is application. In that case, it depends whether the left subterm evaluates to 
a neutral term or a lambda abstraction. In the former case, the evaluation cannot proceed further and we 
construct a new neutral term from the results of evaluating the two subterms. 

When evaluation of the left subterm does yield a lambda abstraction, we //-reduce. As this substitu- 
tion may itself produce new redexes, we evaluate the result of the substitution. 

Here are few example terms in X^ , and their evaluations. Let us write id to denote the term Xx — > x, 
and const to denote the term Xx y — > x, which we use in turn as syntactic sugar for Xx — > Xy — > x. Then 

'Type theorists use ':' or 'e' to denote the type inhabitation relation. In Haskell, the symbol ':' is used as the "cons" operator 
for lists, therefore the designers of Haskell chose the non-standard '::' for type annotations. In this paper, we will stick as close 
as possible to Haskell's syntax, in order to reduce the syntactic gap between the languages involved in the presentation. 
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r ::= 



E 



empty context 
adding a type identifier 
adding a term identifier 



T, a :: * 
T, x :: r 



valid(r) 



valid(r) rhr::* 



valid(e) 



valid(f, a :: *) 



valid(f,x :: r) 



r(et) = * 
r \-a :: * 



r I— t :: * rhr'::* 



(TVAR) 



rhr^T'::* 



(FUN) 



Figure 2. Contexts and well-formed types in k 



(id :: a — > a) y jj. y 

(const :: Off -> yff) -> a -> yff -> yff) id y jj, id 
2.3. Type System 

Type rules are generally of the form T h- e::t, indicating that a term e is of type t in context T. The context 
lists valid base types, and associates identifiers with type information. We write a :: * to indicate that a is 
a base type, and x :: t to indicate that x is a term of type t. Every free variable in both terms and types must 
occur in the context. For instance, if we want to declare const to be of type (/? — > /?) — > a — > ft — > /?, 
we need our context to contain at least: 

a::*,P :: *, const :: (fi — > /?) — > a — > /? — > /? 

Note a and /? are introduced before they are used in the type of const. These considerations motivate the 
definitions of contexts and their validity given in Figure 2. 

Multiple bindings for the same variable can occur in a context, with the rightmost binding taking 
precedence. We write T(z) to denote the information associated with identifier z by context T. 

The last two rules in Figure 2 (TVAR, FUN) explain when a type is well-formed, i.e., when all its free 
variables appear in the context. In the rules for the well-formedness of types as well as in the type rules 
that follow, we implicitly assume that all contexts are valid. 

Note that k^ is not polymorphic: a type identifier represents one specific type and cannot be instan- 
tiated. 

Finally, we can give the type rules (Figure 3). We do not try to infer the types of lambda-bound vari- 
ables. Therefore, in general, we perform only type checking. However, for annotated terms, variables, 
and applications we can easily determine the type. We therefore mark type rules with when the type 
is supposed to be an input to the type checking algorithm and with :: T when the type is produced by the 
type checking algorithm. For now, this is only to provide an intuition, but the distinction will become 
more significant in the implementation. 

Let us first look at the inferable terms. We check annotated terms against their type annotation, and 
then return the type (ANN). The type of a variable can be looked up in the environment (VAR). For 
applications (APP), we deal with the function first, which must be of a function type. We can then check 
the argument against the function's domain, and return the range as the result type. 
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r hi :: * r I— e x 



(ANN) 



r(x) = x 
T I— x ::-[- r 



(var) 



r I— e ::-[• r — > r' r he' r 



(APP) 



r I— (e :: r) ::-[- r 



rhee' :: t r' 



r he::-f r 



(CHK) 



r, x :: t h- e r' 



7 (LAM) 



r h-g "4, x 



TV- /lx — > e ::j, r — > r 



Figure 3. Type rules for 1 



The final two rules are for type checking. If we can infer a type for a term, we can also check it 
against a type if the two types are identical (CHK). A lambda abstraction (LAM) can only be checked 
against a function type. We check the body of the abstraction in an extended context. 

Note that the rules are almost syntax-directed: The rule relating checkable and inferable terms (CHK) 
seems to match any term. However, since there is no rule to infer the type of a lambda abstraction and 
there are no explicit rules to check an annotation, variable or application, the rules can easily be translated 
into a syntax-directed algorithm. 

Here are type judgements - derivable using the above rules - for our two running examples: 

a::*,y::a \- (id :: a — > a) y :: a 

a :: *,y :: a, :: * h- (const :: (/?-> /?)— > a — > /?-> /?) id y :: /?— > fi 
2.4. Implementation 

We now give an implementation of 2_> in Haskell. We provide an evaluator for well-typed terms, and 
functions to type-check terms. The implementation follows the formal description that we have just 
introduced very closely. 

There is a certain freedom in how to implement the rules. We pick an implementation that allows 
us to follow the type system closely, and that reduces the amount of technical overhead to a relative 
minimum, so that we can concentrate on the essence of the algorithms involved. In what follows, we 
briefly discuss our design decisions and mention alternatives. It is important to point out that none of 
these decisions is essential for implementing dependent types. 

Representing bound variables There are different possibilities to represent bound variables - all of 
them have advantages, and in order to exploit a maximum of advantages, we choose different represen- 
tations in different places of our implementation. 

We represent locally bound variables by de Bruijn indices: variable occurrences are represented by 
numbers instead of strings or letters, the number indicating how many binders occur between its binder 
and the occurrence. For example, we can write id as X — > 0, and const as X — > X — > 1 using de Bruijn 
indices. The advantage of this representation is that variables never have to be renamed, i.e., a-equality 
of terms reduces to syntactic equality of terms. 

The disadvantage of using de Bruijn indices is it is rather cumbersome to manipulate terms with free 
variables. Although we can use indices unbound by a lambda to indicate that a variable is free, these 
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indices are relative - whenever we traverse a term and go under a lambda, these references must be 
updated accordingly. 

We therefore represent such free variables in terms using absolute references, i.e., names. The com- 
bination of using numbers for variables local, and names for variables global to the current term is called 
a locally nameless representation [23, 13]. 

Finally, we use higher-order abstract syntax to represent values: values that are functions are rep- 
resented using Haskell functions. This has the advantage that we can use Haskell's function application 
and do not have to implement substitution ourselves, and need not worry about name capture. A slight 
downside of this approach is that Haskell functions can neither be shown nor compared for equality. For- 
tunately, this drawback can easily be alleviated by quoting a value back into a concrete representation. 
We will return to quoting once we have defined the evaluator and the type checker. 

Separating inferable and checkable terms As we have already hinted at in the presentation of the 
type rules for in Figure 3, we choose to distinguish terms for which the type can be read off (called 
inferable terms) and terms for which we need a type to check them. This syntactic distinction between 
checkable and inferable terms dates at least as far back as work by Pierce and Turner [22]. 

Alternatively, we could require every lambda-abstracted variable to be explicitly annotated in the 
abstract syntax - we would then have inferable terms exclusively. It is, however, very useful to be able 
to annotate any term. In the presence of general annotations, it is no longer necessary to require an 
annotation on every lambda-bound variable. In fact, allowing un-annotated lambdas gives us quite a bit 
of convenience without extra cost: applications of the form e (Ax — > e') can be processed without type 
annotation, because the type of x is determined by the type of e. 

Abstract syntax We introduce data types for inferable (Term^) and checkable (Term^) terms, and for 
names. 

data Term T 

= Ann Terrn^ Type 
| Bound Int 
| Free Name 
| Term-]- :@: Term^ 
deriving (Show, Eq) 

data Term^ 
= Inf Term-]- 
| Lam Term^ 
deriving (Show, Eq) 

data Name 

= Global String 
| Local Int 
| Quote Int 
deriving (Show, Eq) 

Annotated terms are represented using Ann. As explained above, we use integers to represent bound vari- 
ables (Bound), and names for free variables (Free). Names usually refer to global entities using strings. 
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When passing a binder in an algorithm, we have to convert a bound variable into a free variable temporar- 
ily, and use Local for that. During quoting, we will use the Quote constructor. The infix constructor : @ : 
denotes application. 

Inferable terms are embedded in the checkable terms via the constructor Inf, and lambda abstractions 
(which do not introduce an explicit variable due to our use of de Bruijn indices) are written using Lam. 

Types consist only of type identifiers (TFree) or function arrows (Fun). We reuse the Name data type 
for type identifiers. In , there are no bound names on the type level, so there is no need for a TBound 
constructor. 

data Type 

= TFree Name 
| Fun Type Type 
deriving {Show, Eq) 

Values are lambda abstractions (VLam) or neutral terms (VNeutral). 

data Value 

= VLam (Value — > Value) 
| VNeutral Neutral 

As described in the discussion on higher-order abstract syntax, we represent function values as Haskell 
functions of type Value — > Value. For instance, the term const - when evaluated - results in the value 
VLam (Xx — > VLam (ly — > x)). 

The data type for neutral terms matches the formal abstract syntax exactly. A neutral term is either a 
variable (NFree), or an application of a neutral term to a value (NApp). 

data Neutral 

= NFree Name 
| NApp Neutral Value 

We introduce a function vfree that creates the value corresponding to a free variable: 

vfree :: Name — > Value 
vfree n = VNeutral (NFree n) 

Evaluation The code for evaluation is given in Figure 4. The functions eval^ and eval^ implement the 
big-step evaluation rules for inferable and checkable terms respectively. Comparing the code to the rules 
in Figure 1 reveals that the implementation is mostly straightforward. 

Substitution is handled by passing around an environment of values. Since bound variables are 
represented as integers, the environment is just a list of values where the i-th position corresponds to the 
value of variable i. We add a new element to the environment whenever evaluating underneath a binder, 
and lookup the correct element (using Haskell's list lookup operator (!!)) when we encounter a bound 
variable. 

For lambda functions (Lam), we introduce a Haskell function and add the bound variable x to the 
environment while evaluating the body. 
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type Env = [Value] 

evalf :: Term T — > Env — > Value 
evalf (Ann e _) d = evali e d 
eval^ {Free x) d = vfree x 
eval^ {Bound i) d — d\\i 

evalf {e : @ : e') d = vapp {eval^ e d) {evali e' d) 

vapp :: Value — » Value — > Value 

vapp {VLamf) v — f v 

vapp {VNeutral n) v = VNeutral {NApp n v) 

evali :: Term^ — > Env Value 

evali {Inf i) d = eval^ i d 

evali {Lam e) d = VLam {Xx — > evali e (x : d)) 

Figure 4. Implementation of an evaluator for 1_> 

Contexts Before we can tackle the implementation of type checking, we have to define contexts. Con- 
texts are implemented as (reversed) lists associating names with either * {HasKind Star) or a type 
{HasType t): 

data Kind — Star 
deriving {Show) 

data Info 

= HasKind Kind 
| HasType Type 
deriving {Show) 

type Context = [(Name, Info)] 

Extending a context is thus achieved by the list "cons" operation; looking up a name in a context is 
performed by the Haskell standard list function lookup. 

Type checking We now implement the rules in Figure 3. The code is shown in Figure 5. The type 
checking algorithm can fail, and to do so gracefully, it returns a result in the Result monad. For simplicity, 
we choose a standard error monad in this presentation: 

type Result a — Either String a 

We use the function throwError :: String — > Result a to report an error. 

The function for inferable terms type^ returns a type, whereas the function for checkable terms fy/^j, 
takes a type as input and returns (). The well-formedness of types is checked using the function kindi. 
Each case of the definitions corresponds directly to one of the rules. 

The type-checking functions are parameterized by an integer argument indicating the number of 
binders we have encountered. On the initial call, this argument is 0, therefore we provide type^ Q as a 
wrapper function. 
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kindi :: Context — > Type — > Kind — > Result () 

kindi r (TFree x) Star 
= case lookup x Y of 

Just (HasKind Star) — > return () 

Nothing — > throwError "unknown identifier" 

kindi T (Tw« k k 1 ) Star 
= do kind^ T k Star 
&/«<ij, T k' Star 

type^. Q :: Context — > Term T — » Result Type 

tyP e 1 0 — type^ 0 

type^ :: Int — » Context — > Term T — » Result Type 

type^ i T (A«« er) 
= do kindi T x Star 
type i i T e x 
return x 
type^ i T (Free x) 

= case lookup x T of 

Just (HasType x) — > return x 

Nothing — > throwError "unknown identifier" 
fy/?e T / T (e : @ : e') 

= do cr <— fype^ / T e 
case a of 

Fwn r r' — > do fy^j, iTe'r 
return x' 

_ — > throwError "illegal application" 

fype^ :: Int — » Context — » Termj, — > Type — » Result () 

type i i T (/«/ e) x 

= do r' <— fy/^t / T e 

unless (x -- x') {throwError "type mismatch") 
type i i T (Lam e) (Fun x x') 

= typei (i + 1) ((Local i, HasType x) : T) 
(substi 0 (Free (Local /)) e) x' 
type i i T _ _ 

= throwError "type mismatch" 



Figure 5. Implementation of a type checker for X. 
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subst^ :: Int — > Term-j- — > Term^ — > Term-]- 
subst^ i r {Ann e r) — Atiti (substi i r e) r 
subst^ i r {Bound j) — if i ==_/ then r else Bound j 
subst^ i r {Free y) = Free y 
subst^ i r {e : @ : e') = subst^ i r e : @ : substi i r e' 

substi :: Int — > Terrm^ — > Termj, — > Termj, 
substi i r {Inf e) = /«/ (subst^ i r e) 
substi i r {Lam e) = Lam {substi {i+ \) r e) 

Figure 6. Implementation of substitution for A_> 

We use this integer to simulate the type rules in the handling of bound variables. In the type rule 
for lambda abstraction, we add the bound variable to the context while checking the body. We do the 
same in the implementation. The counter i indicates the number of binders we have passed, so Local i 
is a fresh name that we can associate with the bound variable. We then add Local i to the context T 
when checking the body. However, because we are turning a bound variable into a free variable, we have 
to perform the corresponding substitution on the body. The type checker will never encounter a bound 
variable; correspondingly the function type~ has no case for Bound. 

Note that the type equality check that is performed when checking an inferable term is implemented 
by a straightforward syntactic equality on the data type Type. Our type checker does not perform unifi- 
cation. 

The code for substitution is shown in Figure 6, and again comprises a function for checkable {substi) 
and one for inferable terms {subst^). The integer argument indicates which variable is to be substituted. 
The interesting cases are the one for Bound where we check if the variable encountered is the one to be 
substituted or not, and the case for Lam, where we increase i to reflect that the variable to substitute is 
referenced by a higher number underneath the binder. 

Our implementation of the simply-typed lambda calculus is now almost complete. A small problem 
that remains is the evaluator returns a Value, and we currently have no way to print elements of type Value. 

Quotation As we mentioned earlier, the use of higher-order abstract syntax requires us to define a 
quote function that takes a Value back to a term. As the VLam constructor of the Value data type takes 
a function as argument, we cannot simply derive Show and Eq as we did for the other types. Therefore, 
as soon as we want to get back at the internal structure of a value, for instance to display results of 
evaluation, we need the function quote. The code is given in Figure 7. 

The function quote takes an integer argument that counts the number of binders we have traversed. 
Initially, quote is always called with 0, so we wrap this call in the function quote 0 . 

If the value is a lambda abstraction, we generate a fresh variable Quote i and apply the Haskell 
function / to this fresh variable. The value resulting from the function application is then quoted at 
level i + 1. We use the constructor Quote that takes an argument of type Int here to ensure that the newly 
created names do not clash with other names in the value. 

If the value is a neutral term (hence an application of a free variable to other values), the function 
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quote 0 :: Value — > Term^ 

quote Q = quote 0 

quote :: Int — > Value — > Term^ 

quote i (VLamf) — Lam {quote (i + 1) (f (vfree (Quote /)))) 
quote i (VNeutral n) = Inf (neutralQuote i n) 

neutralQuote :: Int — > Neutral — > Term-]- 

neutralQuote i (NFree x) — boundfree i x 

neutralQuote i (NApp n v) — neutralQuote i n:@: quote i v 

Figure 7. Quotation in A_> 



neutralQuote is used to quote the arguments. The boundfree function checks if the variable occurring at 
the head of the application is a Quote and thus a bound variable, or a free name: 

boundfree :: Int — > Name — > Term T 
boundfree i {Quote k) = Bound (i — k — 1) 
boundfree i x = Free x 

Quotation of functions is best understood by example. The value corresponding to the term const is 
VLam (Xx — > VLam (Xy — > x)). Applying quote Q yields the following: 

quote 0 (VLam (Xx — > VLam (Xy — > x))) 
= Lam (quote 1 (VLam (Xy — > vfree (Quote 0)))) 
= Lam (Lam (quote 2 (vfree (Quote 0)))) 
= Lam (Lam (neutralQuote 2 (NFree (Quote 0)))) 
= Lam (Lam (Bound 1)) 

When quote moves underneath a binder, we introduce a temporary name for the bound variable. To 
ensure that names invented during quotation do not interfere with any other names, we only use the 
constructor Quote during the quotation process. If the bound variable actually occurs in the body of 
the function, we will sooner or later arrive at those occurrences. We can then generate the correct de 
Bruijn index by determining the number of binders we have passed between introducing and observing 
the Quote variable. 



Examples We can now test the implementation on our running examples. We make the following 
definitions 
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id' = Lam (Inf (Bound 0)) 
const' = Lam {Lam {Inf (Bound 1))) 

tfree a = TFree (Global a) 
free x — Inf (Free (Global x)) 

term\ = Ann id' (Fun (tfree "a") (tfree "a")) :@:free "y" 
term 2 = Ann const' (Fun (Fun (tfree "b") (tfree "b")) 

(Fun (tfree "a") 

(Fun (tfree "b") (tfree "b")))) 

:@: id' :@:free "y" 

env\ = [(Global "y" , HasType (tfree "a")), 

(Global " a" , HasKind Star) ] 
env2 = [(Global "b" , HasKind Star)] -H- env\ 

and then run an interactive session in Hugs or GHCi: 2 

) quote Q (eval^ term\ []) 
Inf (Free (Global "y")) 

) quote Q (eval^ tenri2 []) 
Lam (Inf (Bound 0)) 

) type^ env\ term\ 

Right (TFree (Global "a")) 

) type^ Q env2 term 2 

Right (Fun (TFree (Global "b")) (TFree (Global "b"))) 

We have implemented a parser, pretty-printer and a small read-eval-print loop, 3 so that the above 
interaction can more conveniently take place as: 

)) assume (a :: *) (y :: a) 

)) ((Xx — > x) :: a — > a) y 
y :: a 

)) assume /? :: * 

)) ((/be y -> jc) :: 05 -» /?) -» a -» yS -» y8) (Ajc -» jc) y 
Xx -> x :: /? -> 

With assume, names are introduced and added to the context. For each term, the interpreter performs 
type checking and evaluation, and shows the final value and the type. 

3. Dependent types 

In this section, we will modify the type system of the simply-typed lambda calculus into a dependently 
typed lambda calculus, called An- In the beginning of this section, we discuss the two core ideas of the 

2 Using lhs2TgX [6], one can generate a valid Haskell program from the sources of this paper. The results given here automati- 
cally generated by invoking GHCi whenever this paper is typeset. 

3 The code is included in the paper sources, but omitted from the typeset version for brevity. 
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upcoming changes. We then repeat the formal definitions of abstract syntax, evaluation and type rules, 
and highlight the changes with respect to the simply-typed case. We conclude this section by discussing 
how to adapt the implementation. 

Dependent function space In languages such as Haskell we can define polymorphic functions, such 
as the identity function: 

id :: Va.a — > a 
id = Xx — > x 

By using polymorphism, we can avoid writing the same function on, say, integers and booleans. Poly- 
morphism can be made explicit by interpreting it as a type abstraction. The identity function then takes 
two arguments: a type a and a value of a. Calls to the new identity function must explicitly instantiate 
the identity function with a type: 

id :: Va.a — > a 

id = X(a :: *) (x :: a) — > x 

id Bool True :: Bool 
id Int 3 :: Int 

Polymorphism thus allows types to abstract over types. Why would you want to do anything different? 
Consider the following data types: 

data VecO a = VecO 
data Vec1 a = Vecl a 
data Vec2 a = Vec2 a a 
data Vec3 a — Vec3 a a a 

Clearly, there is a pattern here. We would like to have a single family of types, indexed by the number 
of elements, 

Va :: *.Vra :: Nat.Vec a n 

but we cannot easily do this in Haskell. The problem is that the type Vec abstracts over the value n. 

The dependent function space 'V generalizes the usual function space '— >' by allowing the range 
to depend on the domain. The parametric polymorphism known from Haskell can be seen as a special 
case of a dependent function, motivating our use of the symbol 'V . 4 In contrast to polymorphism, the 
dependent function space can abstract over more than just types. The Vec type above is a valid dependent 
type. 

It is important to note that the dependent function space is a generalization of the usual function 
space. We can, for instance, type the identity function on vectors as follows: 

Va :: *.V« :: Nat.Vv :: Vec a ra.Vec a n 



4 Type theorists call dependent function types IT-types and would write lice : *.Un : Nat.Vec a n instead. This is also why we 
call the calculus l^j. 
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Note that the type v does not occur in the range: this is simply the non-dependent function space already 
familiar to Haskell programmers. Rather than introduce unnecessary variables, such as v, we use the 
ordinary function arrow for the non-dependent case. The identity on vectors then has the following, 
equivalent, type: 

Va :: *.Vn :: Nat.Vec a n — > Vec a n 



In Haskell, one can sometimes 'fake' the dependent function space [11], for instance by defining nat- 
ural numbers on the type level (i.e., by defining data types Zero and Succ). Since the type-level numbers 
are different from the value level natural numbers, one then ends up duplicating a lot of concepts on both 
levels. Furthermore, even though one can lift certain values to the type level in this fashion, additional 
effort - in the form of advanced type class programming - is required to perform any computation on 
such types. Using dependent types, we can parameterize our types by values, and as we will shortly see, 
the normal evaluation rules apply. 



Everything is a term Allowing values to appear freely in types breaks the separation of terms, types, 
and kinds we mentioned in the introduction. There is no longer a syntactic distinction between these 
different levels: everything is a term. In Haskell, the symbol '::' relates entities on different syntactic 
levels: In 0 :: Nat, the 0 is syntactically a value and Nat a type, in Nat :: *, the Nat is a type and * is a 
kind. Now, *, Nat and 0 are all terms. While 0 :: Nat and Nat :: * still hold, the symbol '::' relates two 
terms. We will still use the word "type" to refer to terms p with />::*, and still call * a "kind", but all 
these entities now reside on the same syntactic level. As a consequence, all language constructs are now 
available everywhere. In particular, we have abstraction and application of types and kinds. 

We have now familiarized ourselves with the core ideas of dependently typed systems. Next, we 
discuss what we have to change in in order to accomplish these ideas and arrive at An- 

3.1. Abstract syntax 

We no longer have the need for a separate syntactic category of types or kinds, all constructs for all levels 
are now integrated into the term language: 

e, p,K :: = e :: p annotated term 

* the type of types 

Vx :: p .p' dependent function space 

x variable 

e e' application 

Xx — > e lambda abstraction 

The modifications compared to the abstract syntax of the simply-typed lambda calculus in Section 2.1 
are highlighted. 

We now also use the symbols p and k to refer to terms that play the role of types or kinds, respectively. 

New constructs are imported from what was formerly in the syntax of types and kinds. The kind * is 
now an term. Arrow kinds and arrow types are subsumed by the new construct for the dependent function 
space. Type variables and term variables now coincide. 
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Evaluation in An 



r ::=e 



empty context 
adding a variable 



T, x :: t 



valid(r) r h- r "4 * 



valid(e) 



valid(r,x :: r) 



Figure 9. Contexts in In 



3.2. Evaluation 

The modified evaluation rules are in Figure 8. All the rules are the same as in the simply-typed case in 
Figure 1 , only the rules for the two new constructs are added. Perhaps surprisingly, evaluation now also 
extends to types. But this is exactly what we want: the power of dependent types stems exactly from the 
fact that we can mix values and types, and that we have functions, and thus computations on the type 
level. However, the new constructs are comparatively uninteresting for computation: the * evaluates to 
itself; in a dependent function space, we recurse structurally, evaluating the domain and the range. We 
must extend the abstract syntax of values accordingly: 

v, x ::— n neutral term 



We now use the symbol x for values that play the role of types. 
3.3. Type system 

Before we approach the type rules themselves, we must take a look at contexts again. It turns out that 
because everything is a term now, the syntax of contexts becomes simpler, as do the rules for the validity 
of contexts (Figure 9, compare with Figure 2). 

Contexts now contain only one form of entry, stating the type a variable is assumed to have. Note 
that we always store evaluated types in a context. The precondition T I— x * in the validity rule 
for non-empty contexts no longer refers to a special judgement for the well-formedness of types, but to 
the type rules we are about to define - we no longer need special well-formedness rules for types. The 
precondition ensures in particular that r does not contain unknown variables. 

The type rules are given in Figure 10. Type rules now relate a context, a term and a value, i.e., all 
types are evaluated as soon as possible. Again, we have highlighted the differences from Figure 3. We 



Xx — > v 



* 



the type of types 
dependent function space 
lambda abstraction 
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(ANN) 



(STAR) 



r \- p :: 4 * p JJ, t 
T,x :: r I-/)' "4, * 



r(x) = r r I— e :: t 
v ' (VAR) i- 




T I— x ::-]- r 



rhe:: t r 



(CHK) 



T hee':: t r" 
T, x :: r I— e ::^ x' 



(APP) 



r he ::i x T h- Xx -> e 

Figure 10. Type rules for 



(LAM) 



maintain the difference between rules for inference (::<[•), where the type is an output, and checking (::j,), 
where the type is an input. The new constructs * and V are among the constructs for which we can infer 
the type. As before for we assume that all the contexts that occur in the type rules are valid. 

For annotated terms (ANN), there are two changes. The kind check for the annotation p no longer 
refers to the well-formedness rules for types, but is to the rules for type checking. Furthermore, because 
the annotation p might not be a value, it is evaluated before it is returned. 

The kind * is itself of type * (STAR). Although there are theoretical objections to this choice (see 
Section 5), we believe that for the purpose of this paper, the simplicity of our implementation outweighs 
any such objections. 

The rule for the dependent function space (Pi) is somewhat similar to the well-formedness rule for 
arrow types (FUN) for in Figure 2. Both the domain p and the range p' of the dependent function are 
required to be of kind *. In contrast to the old rule FUN, p' may refer to x, thus we extend T by x :: x 
(where r is the result of evaluating r') while checking p'. 

In a function application (APP), the function must now be of a dependent function type Vx :: r.r'. In 
contrast to an ordinary function type, x' can refer to x. In the result type of the application, we therefore 
substitute the actual argument e' for the formal parameter x in x'. 

Checking an inferable term (CHK) works as before: given a term e and an type x, we first infer a 
type for e, and then check that the inferred type is indeed equal to the expected type x . However, we are 
now dealing with evaluated types, so this is much stronger than syntactic equality of type terms: it would 
be rather unfortunate if Vec a 2 and Vec a (1 + 1) did not denote the same type. Our system indeed 
recognises them as equal, because both terms evaluate to Vec a 2. Most type systems with dependent 
types have a rule of the form: 

F\-e::p p =g p 
Yhev.p 

This rule, referred to as the conversion rule, however, is clearly not syntax directed. The distinction 
between inferable and checkable terms ensures that the only place where we need to apply the conversion 
rule is when a term is explicitly annotated with its type (ANN). 

The final type rule is for checking a lambda abstraction (LAM). The difference here is that the type 
is a dependent function type. Note that the bound variable x may now not only occur in the body of the 
function e. The extended context r, x :: x is therefore used both for type checking the function body and 
kind checking the range x' . 
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To summarize, all the modifications are motivated by the two key concepts we have introduced in 
the beginning of Section 3: the function space is generalized to the dependent function space; types and 
kinds are also terms. 

3.4. Implementation 

The type rules we have given are still syntax-directed and algorithmic, so the general structure of the 
implementation can be reused for An- In the following, we go through all aspects of the implementation, 
but only discuss the definitions that have to be modified. 

Abstract syntax We no longer require Type and Kind, but instead add two new constructors to Term-]- 
and replace the occurrence of Type in Ann with a Term^: 

data Term T 

= Ann Term Termj, 




Bound Int 
Free Name 
Term-j- :@: Termj, 



deriving (Show, Eq) 

We also extend the type of values with the new constructs. 

data Value 

— VLam (Value — > Value) 
| VStar 

| VPi Value (Value -> Value) 
| VNeutral Neutral 

As before, we use higher-order abstract syntax for the values, i.e., we encode binding constructs 
using Haskell functions. With VPi, we now have a new binding construct. In the dependent function 
space, a variable is bound that is visible in the range, but not in the domain. Therefore, the domain is 
simply a Value, but the range is represented as a function of type Value — > Value. 

Evaluation To adapt the evaluator, we just add the two new cases for Star and Pi to the evalf function, 
as shown in Figure 11 (see Figure 4 for the evaluator for Evaluation of Star is trivial. For a Pi 

type, both the domain and the range are evaluated. In the range, where the bound variable x is visible, 
we have to add it to the environment. 

Contexts Contexts map variables to their types. Types are on the term level now. We store types in 
their evaluated form, and thus define: 

type Type = Value 

type Context = [(Name, Type)] 



1018 



A. Loh, C. McBride, W. Swierstra/A tutorial implementation of a dependently typed lambda calculus 



eval^ Star d = VStar 

eval^ (Pi z z') d = VPi (evali z d) (Xx — > evali %' (x : d)) 

subst T i r (Ann e i z) = Ann (subst i i r e±) (subst i i r z) 
subst^ i r Star = Star 

subst^ i r (Pi z z') = Pi (substi l ' r r ) (substi (i + 1) r z') 



quote i VStar = Inf Star 
quote i (VPi v f) 




Figure 11. Extending evaluation, substitution and quotation to In 



Type checking Let us go through each of the cases in Figure 12 one by one. The cases for for 
comparison - are in Figure 5. For an annotated term, we first check that the annotation is a type of 
kind *, using the type-checking function type^. We then evaluate the type. The resulting value r is used 
to check the term e. If that succeeds, the entire term has type v. Note that we assume that the term under 
consideration in type^ has no unbound variables, so all calls to evali take an empty environment. 
The (evaluated) type of Star is VStar. 

For a dependent function type, we first kind-check the domain r. Then the domain is evaluated to v. 
The value is added to the context while kind-checking the range - the idea is similar to the type-checking 
rules for Lam in X^ and X u . 

In the application case, the type inferred for the function is a Value now. This type must be of the form 
VPi z z', i.e., a dependent function type. In the corresponding type rule in Figure 10, the bound variable 
x is substituted by e' in the result type z' . In the implementation, z' is a function, and the substitution is 
performed by applying it to the (evaluated) e' . 

In the case for Inf, we have to perform the type equality check. In contrast to the type rules, we cannot 
compare values for equality directly in Haskell. Instead, we quote them and compare the resulting terms 
syntactically. 

In the case for Lam, we require a dependent function type of form VPi z z' now. As in the corre- 
sponding case for /!_>, we add the bound variable (of type r) to the context while checking the body. 
But we now perform substitution on the function body e (using substi) and on the result type z' (by 
applying z'). 

We thus only have to extend the substitution functions, by traversing the type in an annotated term, 
and by adding the two cases for Star and Pi, as shown in Figure 11. There's nothing to subsitute for Star. 
For Pi, we have to increment the counter before substituting in the range because we pass a binder. 

Quotation To complete our implementation of X n , we only have to extend the quotation function. This 
operation is more important than for , because as we have seen, it is used in the equality check during 
type checking. Again, we only have to add equations for VStar and VPi, which are shown in Figure 11. 

Quoting VStar yields Star. Since the dependent function type is a binding construct, quotation for 
VPi works similar to quotation of VLam: to quote the range, we increment the counter i, and apply the 
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type t :: Int — > Context — > Term T — > Result Type 

type^ i Y (Ann e p ) 

= do type^ i T p VStar 
let x = evali p [ ] 
type, i Y e x 
return x 
type* i Y Star 

= return VStar 
type r i r (Pi p p') 

= do type± i Y p VStar 
let x = evali p [ ] 
type^ (i + 1) ((Local i, x) : T) 

(substi 0 (Free (Local /)) p') VStar 
return VStar 
type^ i Y (Free x) 

= case lookup x Y of 
/M5t r — > return x 

Nothing — > throwError "unknown identifier" 
fype^. / T (e : @ : e') 

= do cr <— / r e 

case cr of 

VPi x x' — > do fyP e x iTc'r 

return (x' (evali e' [])) 
_ — > throwError "illegal application" 

type^ :: Int — » Context — > Term^ —> Type — > Result () 

type i i T (7n/e) v 

= do v' <— fype-j. / Y e 

unless (quote Q v == quote Q v') (throwError "type mismatch") 
fypei / T (Lam e) (VPi x x') 

= type i (i + 1) ((Local i, x ) : T) 

(substi 0 (Free (Local /)) e) (r' (v/ree (Local /))) 

9p«4, «' r _ _ 

= throwError "type mismatch" 



Figure 12. Implementation of a type checker for In 
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Haskell function representing the range to Quote i. 
3.5. Where are the dependent types? 

We now have adapted our type system and its implementation to dependent types, but unfortunately, we 
have not yet seen any examples. 

Again, we have written a small interpreter around the type checker we have just presented, and we 
can use it to define and check, for instance, the polymorphic identity function (where the type argument 
is explicit), as follows: 

)) let id = (la x — > x) :: V(cc :: *).a — > a 

id :: V(x :: *) (y :: x).x 

)) assume (Bool :: *) (False :: Bool) 

)) id Bool 

Xx — > x :: Vx :: Bool. Bool 
}} id Bool False 
False :: Bool 

This is more than we can do in the simply-typed setting, but it is by no means spectacular and does not 
require dependent types. Unfortunately, while we have a framework for dependent types in place, we 
cannot write any interesting programs as long as we do not add at least a few specific data types to our 
language. 

4. Beyond /In 

In Haskell, data types are introduced by special data declarations: 

data Nat — Zero \ Succ Nat 

This declaration introduces a new type Nat, together with two constructors Zero and Succ. In this section, 
we investigate how to extend our language with data types, such as natural numbers. 

Obviously, we will need to add the type Nat together with its constructors; but how should we define 
functions, such as addition, that manipulate numbers? In Haskell, we would define a function that pattern 
matches on its arguments and makes recursive calls to smaller numbers: 

plus :: Nat — > Nat — > Nat 

plus Zero n = n 

plus (Succ k) n = Succ (plus k ri) 

In our calculus so far, we can neither pattern match nor make recursive calls. How could we hope to 
define plus? 

In Haskell, we can define recursive functions on data types using a fold [16]. Rather than introduce 
pattern matching and recursion, and all the associated problems, we define functions over natural num- 
bers using the corresponding fold. In a dependently type setting, however, we can define a slightly more 
general version of a fold called the eliminator. 
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k JJ, Z 

Nat JJ. Nat Zero JJ. Zero Succ k JJ. Succ I 
k JJ Zero mz JJ. v A JJ. Swcc Z mi / (natElim m mzms I) l\, v 



natElim mmz ms k JJ, v natElim mmzms k JJ. v 

JJ. n 

natElim mmzms k \\, natElim mmzms n 
Figure 13. Evaluation of natural numbers 

r h-Jfc::4, Nat 



n-Nat:: T * r h- Zero :: T Nat r h- Swcc A: :: t Nat 

T \-m::i Nat -» * 
m Zero JJ. r r I— mz "j, r 
VZ :: Nat.m A — > m (Succ I) JJ. r' r h ms::^t' 
T\-k::i Nat 
T I— natElim mmzms kv.^mk 

Figure 14. Typing rules for natural numbers 



The fold for natural numbers has the following type: 

foldNat :: Vcc :: *.a — > (a — > a) — > Nat — > a 

This much should be familiar. In the context of dependent types, however, there is no need for the type a 
to be uniform across the constructors for natural numbers: rather than use a :: *, we use m :: Nat — > *. 
This leads us to the following type of natElim: 

natElim :: Vm :: Nat — > *. m Zero 

— > (VZ :: Nat.m Z — > m (Smcc Z)) 
-> VA :: Nat.m A 

The first argument of the eliminator is the sometimes referred to as the motive [10]; it explains the 
reason we want to eliminate natural numbers. The second argument corresponds to the base case, where 
k is Zero; the third argument corresponds to the inductive case where k is Succ I, for some Z. In the 
inductive case, we must describe how to construct m (Succ Z) from Z and m Z. The final argument of 
natElim is a natural number k that is eliminated, the result being of type m k. 

Inspired by the discussion above, we show evaluation and typing rules for natural numbers in Fig- 
ures 13 and 14. Note that we treat natElim not as a function, but as a term former that has to be applied 
to all of its arguments. The evaluation rules implement the behaviour one would expect from a fold 
function. We need a case to deal with the fact that the natural number k can evaluate to a neutral term. In 
this case, evaluation of the eliminator is stuck and we return a neutral term containing the application of 
the eliminator. 
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evalf Nat d = VNat 

eval^ Zero d = VZero 

eval^ (Succ k) d = VSucc {eval^ k d) 

eval^ (NatElim m mz ms k) d 
= let mzVal = eval^ mz d 
msVal — evali ms d 
rec Wal = 
case kVal of 

VZero — > mzVal 

VSucc I — > msVal 'vapp' I 'vapp' rec I 

VNeutral k — > VNeutral 

(NNatElim {eval^ m d) mzVal msVal k) 
_ — > error "internal: eval natElim" 
in rec (eval^ k d) 

Figure 15. Extending the evaluator for natural numbers 

4.1. Implementing natural numbers 

In summary, adding natural numbers to our language involves adding three separate elements: the 
type Nat, the constructors Zero and Succ, and the eliminator natElim. To implement these three com- 
ponents, We extend the abstract syntax and correspondingly add new cases to the evaluation and type 
checking functions. These new cases do not require any changes to existing code; we choose to focus 
only on the new code fragments. 

Abstract Syntax To implement natural numbers, we extend our abstract syntax as follows: 

data Term T — ... 
| Nat 

| Zero 

| Succ Term j. 

We add four constructors to Term-]-: Nat for the datatype, Zero and Succ for the data constructors, and 
NatElim for the eliminator. The NatElim constructor is fully applied: it expects no further arguments. 

Evaluation We need to rethink our data type for values. Previously, values consisted exclusively of 
lambda abstractions and 'stuck' applications. Clearly, we will need to extend the data type for values to 
cope with the new constructors for natural numbers. 

data Value = . . . 

| VNat 

| VZero 

| VSucc Value 
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type^ i r Nat = return VStar 

type^ i r Zero = return VNat 

type^ i r (Succ k) = 
do type^ i T k VNat 
return VNat 
type^ i T (NatElim m mz ms k) = 

do type i i T m (VPi VNat (const VStar)) 
let mVal = eval^ m [ ] 
type^ i r mz. (mVal 'vapp' VZero) 

type x i T ms (VPi VNat (XI -> VPi (mVal 'vapp' I) (X -> mVal "vapp" VSucc /))) 
type i i T k VNat 
let = evali k [ ] 
return (mVal 'vapp' kVal) 

Figure 16. Extending the type checker for natural numbers 

Introducing the eliminator, however, also complicates evaluation. The eliminator for natural numbers 
can also be stuck when the number being eliminated does not evaluate to a constructor. Correspondingly, 
we extend the data type for neutral terms to cover this case: 

data Neutral = . . . 

| NNatElim Value Value Value Neutral 

The implementation of evaluation in Figure 15 closely follows the rules in Figure 13. The elimi- 
nator is the only interesting case. Essentially, the eliminator evaluates to the Haskell function with the 
behaviour you would expect: if the number being eliminated evaluates to VZero, we evaluate the base 
case mz; if the number evaluates to VSucc I, we apply the step function ms to the predecessor / and the 
recursive call to the eliminator; finally, if the number evaluates to a neutral term, the entire expression 
evaluates to a neutral term. If the value being eliminated is not a natural number or a neutral term, this 
would have already resulted in a type error. Therefore, the final catch-all case should never be executed. 

Typing Figure 16 contains the implementation of the type checker that deals with natural numbers. 
Checking that Zero and Succ construct natural numbers is straightforward. 

Type checking the eliminator is bit more involved. Remember that the eliminator has the following 
type: 

natElim :: Vm :: Nat — > *. m Zero 

— > (V/ :: Nat.m / — > m (Succ I)) 
— > Vfc :: Nat.m k 

We begin by type checking and evaluating the motive m. Once we have the value of m, we type check 
the two branches. The branch for zero should have type m Zero; the branch for successors should have 
type VZ :: Nat.m Z — > m (Succ I). Despite the apparent complication resulting from having to hand code 
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complex types, type checking these branches is exactly what would happen when type checking a fold 
over natural numbers in Haskell. Finally, we check that the k we are eliminating is actually a natural 
number. The return type of the entire expression is the motive, accordingly applied to the number being 
eliminated. 

Other functions To complete the implementation of natural numbers, we must also extend the aux- 
iliary functions for substitution and quotations with new cases. All new code is, however, completely 
straightforward, because no new binding constructs are involved. 

Addition With all the ingredients in place, we can finally define addition in our interpreter as fol- 
lows: 

)) let plus = natElim (X_ — > Nat — > Nat) 
(An — > n) 

(Ik rec n — > Succ (rec n)) 
plus :: V(x :: Nat) (y :: Nat). Nat 

We define a function plus by eliminating the first argument of the addition. In each case branch, we must 
define a function of type Nat — > Nat; we choose our motive correspondingly. In the base case, we must 
add zero to the argument n - we simply return n. In the inductive case, we are passed the predecessor k, 
the recursive call rec (that corresponds to adding k), and the number n, to which we must add Succ k. 
We proceed by adding k to n using rec, and wrapping an additional Succ around the result. After having 
defined plus, we can evaluate simple additions in our interpreter: 5 

)) plus 40 2 
42 :: Nat 

4.2. Implementing vectors 

Natural numbers are still not particularly exciting: they are still the kind of data type we can write quite 
easily in Haskell. As an example of a data type that really makes use of dependent types, we show how 
to implement vectors. 

As was the case for natural numbers, we need to define three separate components: the type of 
vectors, its constructors, and the eliminator. We have already mentioned that vectors are parameterized 
by both a type and a natural number: 

Va :: *.\/k :: Nat.Vec a k:: * 

The constructors for vectors are analogous to those for Haskell lists. The only difference is that their 
types record the length of the vector: 

Nil :: Va :: *.Vec a Zero 

Cons :: Va :: *.V& :: Nat. a — > Vec a k — > Vec a (Succ k) 



5 For convenience, our parser and pretty-printer support literals for natural numbers. For instance, 2 is translated to 
Succ (Succ Zero) :: Nat on the fly. 
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The eliminator for vectors behaves essentially the same as foldr on lists, but its type is a great deal more 
specific (and thus, more involved): 

vecElim :: Voc :: *.Vm :: (V& :: Nat.Vec a k — > *). 

m Zero (Nil a) 
— > (V/ :: Nat.Vx :: a.\/xs :: Vec a I. 

ml xs — > m (Succ I) (Cons a I x xs)) 
— > \/k :: Nat.Vxs :: Vec a k.m k xs 

The whole eliminator is quantified over the element type a of the vectors. The next argument of the 
eliminator is the motive. As was the case for natural numbers, the motive is a type (kind *) parameterized 
by a vector. As vectors are themselves parameterized by their length, the motive expects an additional 
argument of type Nat. The following two arguments are the cases for the two constructors of Vec. The 
constructor Nil is for empty vectors, so the corresponding argument is of type m Zero (Nil a). The case 
for Cons takes a number I, an element x of type a , a vector xs of length /, and the result of the recursive 
application of the eliminator of type m I xs. It combines those elements to form the required type, for 
the vector of length Succ I where x has been added to xs. The final result is a function that eliminates a 
vector of any length. 

The type of the eliminator may look rather complicated. However, if we compare with the type of 
foldr on lists 

foldr :: Voc :: *.Vm :: *.m — > (a — > m — > m) — > [a] — > m 

we see that the structure is the same, and the additional complexity stems only from the fact that the 
motive is parameterized by a vector, and vectors are in turn parameterized by natural numbers. 

Not all of the arguments of vecElim are actually required - some of the arguments can be inferred 
from others, to reduce the noise and make writing programs more feasible. We would like to remind you 
that A u is designed to be a very explicit, low-level language. 

Abstract syntax As was the case for natural numbers, we extend the abstract syntax. We add the type 
of vectors, the vector constructors, and the eliminator to Term-j-. 

data Term T = . . . 
| Vec Term^ Term^ 
| Nil Termj, 

| Cons Term^ Term^ Term^ Term^ 

| VecElim Termj, Termj, Termj, Termj, Termj, Termj, 

Note that also Nil takes an argument, because both constructors are polymorphic in the element type. 
For vectors and for many other datatypes there is some flexibility as to where the constructors are placed: 
we could omit the type argument from Nil and Cons and the length argument from Cons and place 
the constructors in Term^ rather than Term-]-. We would have to place less arguments on the individual 
constructor applications at the price that we have to explicitly annotate vector expressions. 
We also extend the data types for values and neutral terms: 
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eval^ (VecElim a m mn mc k xs) d 
let mnVal — eval^ mn d 
mcVal — eval± mc d 
rec kVal xsVal = 
case xsVal of 



VCons _l x xs — > foldl vapp mcVal [I, x, xs, rec I xs] 
VNeutral n — > VNeutral 

(NVecElim (eval^ a d) (eval^ m d) 
mnVal mcVal kVal n) 
_ — > error "internal : eval vecElim" 

in rec (eval^ k d) (eval^ xs d) 



data Value = . . . 
| VNil Value 

| VCons Value Value Value Value 
| Wee Value Value 

data Neutral = . . . 

I NVecElim Value Value Value Value Value Neutral 



Evaluation Evaluation of constructors of the Vec type proceeds structurally, turning terms into their 
value counterparts. Once again, the only interesting case is the evaluation of the eliminator for vectors, 
shown in Figure 17. As indicated before, the behaviour resembles a fold on lists: depending on whether 
the vector is a VNil or a VCons, we apply the appropriate argument. In the case for VCons, we also 
call the eliminator recursively on the tail of the vector (of length /). If the eliminated vector is a neutral 
element, we cannot reduce the eliminator, and produce a neutral term again. 

Type checking We extend the type checker as shown in Figure 18. The code is relatively long, but 
keeping the types of each of the constructs in mind, there are absolutely no surprises. 

As for natural numbers, we have omitted the new cases for substitution and quotation, because they 
are entirely straightforward. 



VNil 



— > mnVal 



Figure 17 



Implementation of the evaluation of vectors 



Append We are now capable of demonstrating a real dependently typed program in action, a function 
that appends two vectors while keeping track of their lengths. The definition in the interpreter looks as 
follows: 
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type^ i Y (Vec a k) — 
do type, i Y a VStar 

type^ i Y k VNat 

return VStar 
type^ i Y (Nil a) = 
do type, i Y a VStar 

let aVal = evali a [ ] 

return (Wee aVal VZero) 
type^ i Y (Cons a k x xs) = 
do type^ i Y a VStar 

let aVal = evali a [] 

type^ i Y k VNat 

let kVal = evali k [ ] 

type^ i Y x aVal 

type, i Y xs (Wee aVal kVal) 

return (Wee aVal (VSucc kVal)) 
type^ i Y (VecElim a mmn me k vs) = 
do type^ i Y a VStar 

let aVal = evali a [] 

type i i Y m 

(VPi VNat (Ik VPi (Wee aVal k) (X_ VStar))) 
let mVal = evali m [ ] 

type i i Y mn (foldl vapp mVal [VZero, VNil aVal]) 
type i i Y mc 
(VPi VNat (XI 

VPi aVal (Xy 

VPi (Wee aVal I) (Xys 

VPi (foldl vapp mVal [I, ys]) (X_ — > 

(foldl vapp mVal [VSucc I, VCons aVal I y ys})))))) 
type i i Y k VNat 
let kVal — evali k [ ] 
type i i Y vs (Wee aVal kVal) 
let vsVal = evali vs [ ] 
return (foldl vapp mVal [kVal, vsVal]) 



Figure 18. Extending the type checker for vectors 
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)) let append = 

(/La — > vecElim a 

(1m _ — > V(n :: Nat).Vec a « — > Vec a (p/ws m «)) 
(A_ v — > v) 

(Am v vs rec nw^> Cons a (plus m n) v (rec n w))) 
:: V(a :: *) (m :: Nat) (v :: Vec a m) (n :: Nat) (w :: Vec a n). 
Vec a {plus m n) 

Like for plus, we define a binary function on vectors by eliminating the first argument. The motive is 
chosen to expect a second vector. The length of the resulting vector is the sum of the lengths of the 
argument vectors plus m n. Appending an empty vector to another vector v results in v. Appending a 
vector of the form Cons m v vs to a vector v works by invoking recursion via rec (which appends vs to 
w) and prepending v. Of course, we can also apply the function thus defined: 

)) assume (a :: *) (x :: a) (y :: a) 

)) append a 2 (Cons a 1 x (Cons a 0 x (Nil a))) 

1 (Cons a 0 y (Nil a)) 
Cons a 2 x (Cons a 1 x (Cons a 0 y (Nil a))) :: Vec a 3 

We assume a type a with two elements x and y, and append a vector containing two x's to a vector 
containing one y. 

4.3. Discussion 

In this section we have shown how to add two data types to our core theory: natural numbers and 
vectors. Using exactly the same principles, many more data types can be added. For example, for any 
natural number n, we can define the type Fin n that contains exactly n elements. In particular, Fin 0, Fin 1 
and Fin 2 are the empty type, the unit type, and the type of booleans respectively. Furthermore, Fin can 
be used to define a total projection function from vectors, of type 

project :: V(a :: *) (n :: Nat).Vec a n — > Fin n — > a 
Another interesting dependent type is the equality type 

Eq :: V(a :: *).a — > a — > * 
with a single constructor 

Refl :: V(a :: *) (x :: a) — > Eq a x x 
and eliminator 

eqElim :: V(a :: *).V(m :: V(x :: a).V(y :: a).Eq a xy — > *). 

(V(z ::a).mzz (Refl a z)) 
— > V(x :: a).V(y :: a).V(p :: Eq a x y).m xy p 

Using Eq, we can state and prove theorems about our code directly in An- For instance, the type 
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V(oc :: *) (n :: Nat).Eq Nat (plus n Zero) n 

states that Zero is the right-neutral element of addition. Any term of that type serves as a proof of that 
theorem, via the Curry-Howard isomorphism. 

These examples and a few more are included with the interpreter in the paper sources, which can be 
downloaded via the /l n homepage [7]. More about suitable data types for dependently typed languages 
and writing dependently typed programs can be found in another tutorial [12]. 

Throughout this section, we have chosen to extend the abstract syntax of our language for every data 
type we add. Alternatively, we could use the Church encoding of data types, e.g., representing natural 
numbers by the type V(ec :: *).a — > (a — > a) — > a. Although this choice may seem to require less effort, 
it does introduce some problems. Although we can use the Church encoding to write simple folds, we 
cannot write dependently typed programs that rely on eliminators without extending our theory further. 
This makes it harder to write programs with an inherently dependent type, such as our append function. 
As our core theory should be able to form the basis of a dependently typed programming language, we 
chose to avoid using such an encoding. 

5. Toward dependently typed programming 

The calculus we have described is far from a real programming language. Although we can write, type 
check, and evaluate simple expressions there is still a lot of work to be done before it becomes feasible 
to write large, complex programs. In this section, we do not strive to enumerate all the problems that 
large-scale programming with dependent types must face, let alone solve them. Instead, we try to sketch 
how a programming language may be built on top of the core calculus we have seen so far and point you 
to related literature. 

As our examples illustrate, programming with eliminators does not scale. Epigram [15] uses a clever 
choice of motive to make programming with eliminators a great deal more practical [9, 14]. By choosing 
the right motive, we can exploit type information when defining complicated functions. Eliminators may 
not appear to be terribly useful, but they form the foundations on which dependently typed programming 
languages may be built. 

Writing programs with complex types in one go is not easy. Epigram and Agda [19] allow pro- 
grammers to put 'holes' in their code, leaving parts of their programs undefined [20]. Programmers can 
then ask the system what type a specific hole has, effectively allowing the incremental development of 
complex programs. 

As it stands, the core system we have presented requires programmers to explicitly instantiate poly- 
morphic functions. This is terribly tedious! Take the append function we defined: of its five arguments, 
only two are interesting. Fortunately, uninteresting arguments can usually be inferred. Many program- 
ming languages and proof assistants based on dependent types have support for implicit arguments that 
the user can omit when calling a function. Note that these arguments need not be types: the append 
function is 'polymorphic' in the length of the vectors. 

Finally, we should reiterate that the type system we have presented is unsound. As the kind of * is 
itself *, we can encode a variation of Russell's paradox, known as Girard's paradox [3]. This allows us 
to create an inhabitant of any type. To fix this, the standard solution is to introduce an infinite hierarchy 
of types: the type of * is *i, the type of *i is * 2 , and so forth. 
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6. Discussion 

There is a large amount of relevant literature regarding both implementing type systems and type theory. 
Pierce's book [21] is an excellent place to start. Martin-Lof's notes on type theory [8] are still highly 
relevant and form an excellent introduction to the subject. More recent books by Nordstrom et al. [17] 
and Thompson [24] are freely available online. 

There are several dependently typed programming languages and proof assistants readily available. 
Coq [2] is a mature, well-documented proof assistant. While it is not primarily designed for dependently 
typed programming, learning Coq can help get a feel for type theory. Haskell programmers may feel 
more at home using recent versions of Agda [18], a dependently typed programming language. Not 
only does the syntax resemble Haskell, but functions may be defined using pattern matching and general 
recursion. Finally, Epigram [15, 12] proposes a more radical break from functional programming as 
we know it. While the initial implementation is far from perfect, many of Epigram's ideas are not yet 
implemented elsewhere. 

Other implementations of the type system we have presented here have been published elsewhere [1, 
4, 5]. These articles, however, tend to focus on proving that an implementation is correct and satisfies 
certain meta-theoretical properties. The focus of our paper is somewhat different: we have chosen to 
describe a concrete implementation of a type checker as a vehicle for explanation. Furthermore, we have 
tried to collect and document those implementation techniques that we found useful in our implementa- 
tion. 

In the introduction we mentioned some of the concerns functional programmers have regarding de- 
pendent types. Type checking a language with dependent types is not necessarily undecidable - indeed, 
the type checker we have presented here will only fail to terminate for certain contrived examples [3]. 
The phase distinction between evaluation and type checking becomes more subtle, but is not lost. The 
fusion of types and terms introduces new challenges, but also has a lot to offer. Most importantly, though, 
getting started with dependent types is not as hard as you may think. We hope to have whet your appetite, 
guiding you through your first steps, but encourage you to start exploring dependent types yourself! 
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